From bde5422d1831ce46b91200cde39ba607bc7704d4 Mon Sep 17 00:00:00 2001 From: "vladyslav.guriev" Date: Wed, 18 Oct 2023 14:47:54 +0300 Subject: [PATCH 1/3] Trellix NX docs --- .../integrations/network/trellix_nx.md | 41 +++++++++++++++++++ mkdocs.yml | 3 ++ 2 files changed, 44 insertions(+) create mode 100644 docs/xdr/features/collect/integrations/network/trellix_nx.md diff --git a/docs/xdr/features/collect/integrations/network/trellix_nx.md b/docs/xdr/features/collect/integrations/network/trellix_nx.md new file mode 100644 index 0000000000..87f20a3f9b --- /dev/null +++ b/docs/xdr/features/collect/integrations/network/trellix_nx.md @@ -0,0 +1,41 @@ +uuid: bae128bb-98c6-45f7-9763-aad3451821e5 +name: Trellix Network Security +type: intake + +## Overview + +Trellix Network Security is an effective cyberthreat protection solution that helps your organization minimize the risk of costly breaches by accurately detecting and immediately stopping advanced, targeted, and other evasive attacks hiding in internet traffic. + + +{!_shared_content/operations_center/detection/generated/suggested_rules_bae128bb-98c6-45f7-9763-aad3451821e5_do_not_edit_manually.md!} + +{!_shared_content/operations_center/integrations/generated/bae128bb-98c6-45f7-9763-aad3451821e5.md!} + +## Configure + +This setup guide will show you how to forward your Trellix Network Security logs to Sekoia.io by means of a syslog transport channel. + +### Prerequisites + +You should have: + +- Have an admin access in Trellix platform. +- Have an internal log concentrator (Rsyslog) + +### Enable Syslog forwarding for Trellix Network Security + +1. Log onto the Trellix NX console +2. Go to `Settings > Notifications` +3. Click on `rsyslog` and check the `Event type` check box below +4. In the Settings panel, select the `Default format` as `CEF` +5. In the `Rsyslog Server Listing`, type a name for the new entry then click on the button `Add Rsyslog Server` +6. For the new server, check the `Enabled` checkbox, type the ip address of your syslog concentrator +7. Click on the `Update` button to validate the configuration +8. (Optional) Click on the `Test-fire` button if you want to test the forwarding of the logs + +### Create the intake + +Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format Trellix Network Security. + +### Configure the Rsyslog server +Please consult the [Rsyslog Transport](../../../ingestion_methods/rsyslog/) documentation to forward these logs to Sekoia.io. diff --git a/mkdocs.yml b/mkdocs.yml index 5b77d60c3c..31c23958cb 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -210,6 +210,7 @@ nav: - Squid: xdr/features/collect/integrations/network/squid.md - Stormshield SNS: xdr/features/collect/integrations/network/stormshield_network_security.md - Suricata: xdr/features/collect/integrations/network/suricata.md + - Trellix Network Security: xdr/features/collect/integrations/network/trellix_nx.md - Varonis Data Security: xdr/features/collect/integrations/network/varonis_data_security.md - Vectra Cognito Detect: xdr/features/collect/integrations/network/vectra.md - Wallix: xdr/features/collect/integrations/network/wallix.md @@ -621,6 +622,7 @@ plugins: integrations/unbound.md: xdr/features/collect/integrations/application/unbound.md integrations/vade.md: xdr/features/collect/integrations/email/vade.md integrations/vectra-cognito-detect.md: xdr/features/collect/integrations/network/vectra.md + integrations/trellix_nx.md: xdr/features/collect/integrations/network/trellix_nx.md integrations/wallix-bastion.md: xdr/features/collect/integrations/network/wallix.md integrations/wazuh.md: xdr/index.md integrations/windows.md: xdr/features/collect/integrations/endpoint/windows.md @@ -728,6 +730,7 @@ plugins: operation_center/integration_catalog/network/squid.md: xdr/features/collect/integrations/network/squid.md operation_center/integration_catalog/network/stormshield_network_security.md: xdr/features/collect/integrations/network/stormshield_network_security.md operation_center/integration_catalog/network/suricata.md: xdr/features/collect/integrations/network/suricata.md + operation_center/integration_catalog/network/trellix_nx.md: xdr/features/collect/integrations/network/trellix_nx.md operation_center/integration_catalog/network/vectra.md: xdr/features/collect/integrations/network/vectra.md operation_center/integration_catalog/network/wallix.md: xdr/features/collect/integrations/network/wallix.md operation_center/integration_catalog/network/zeek.md: xdr/features/collect/integrations/network/zeek.md From cbfb10e9a58bd12105c2f5a70a0be12cb9047042 Mon Sep 17 00:00:00 2001 From: "vladyslav.guriev" Date: Wed, 18 Oct 2023 15:10:51 +0300 Subject: [PATCH 2/3] Cleanup --- mkdocs.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/mkdocs.yml b/mkdocs.yml index 31c23958cb..d6c2216302 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -622,7 +622,6 @@ plugins: integrations/unbound.md: xdr/features/collect/integrations/application/unbound.md integrations/vade.md: xdr/features/collect/integrations/email/vade.md integrations/vectra-cognito-detect.md: xdr/features/collect/integrations/network/vectra.md - integrations/trellix_nx.md: xdr/features/collect/integrations/network/trellix_nx.md integrations/wallix-bastion.md: xdr/features/collect/integrations/network/wallix.md integrations/wazuh.md: xdr/index.md integrations/windows.md: xdr/features/collect/integrations/endpoint/windows.md @@ -730,7 +729,6 @@ plugins: operation_center/integration_catalog/network/squid.md: xdr/features/collect/integrations/network/squid.md operation_center/integration_catalog/network/stormshield_network_security.md: xdr/features/collect/integrations/network/stormshield_network_security.md operation_center/integration_catalog/network/suricata.md: xdr/features/collect/integrations/network/suricata.md - operation_center/integration_catalog/network/trellix_nx.md: xdr/features/collect/integrations/network/trellix_nx.md operation_center/integration_catalog/network/vectra.md: xdr/features/collect/integrations/network/vectra.md operation_center/integration_catalog/network/wallix.md: xdr/features/collect/integrations/network/wallix.md operation_center/integration_catalog/network/zeek.md: xdr/features/collect/integrations/network/zeek.md From 8a3c683f8ee785eae01b90c2e5f5093e5d7ca4c0 Mon Sep 17 00:00:00 2001 From: vg-svitla <131353512+vg-svitla@users.noreply.github.com> Date: Thu, 19 Oct 2023 16:54:36 +0300 Subject: [PATCH 3/3] Update docs/xdr/features/collect/integrations/network/trellix_nx.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sébastien Quioc --- docs/xdr/features/collect/integrations/network/trellix_nx.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/xdr/features/collect/integrations/network/trellix_nx.md b/docs/xdr/features/collect/integrations/network/trellix_nx.md index 87f20a3f9b..0b9369ad25 100644 --- a/docs/xdr/features/collect/integrations/network/trellix_nx.md +++ b/docs/xdr/features/collect/integrations/network/trellix_nx.md @@ -6,6 +6,8 @@ type: intake Trellix Network Security is an effective cyberthreat protection solution that helps your organization minimize the risk of costly breaches by accurately detecting and immediately stopping advanced, targeted, and other evasive attacks hiding in internet traffic. +!!! warning + Important note - This format is currently in beta. We highly value your feedback to improve its performance. {!_shared_content/operations_center/detection/generated/suggested_rules_bae128bb-98c6-45f7-9763-aad3451821e5_do_not_edit_manually.md!}